qgis

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

qgis records in CISA KEV

No qgis vulnerabilities are listed in CISA KEV.

Records

3 records

TI-2026-19734 CVE-2026-24480

QGIS had validated RCE and Repository Takeover via GitHub Actions

HIGH 73

QGIS is a free, open source, cross platform geographical information system (GIS) The repository contains a GitHub Actions workflow called "pre-commit checks" that, before commit 76a693cd91650f9b4e83edac525e5e4f90d954e9,…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00454 Published 2026-01-27 Fixed in 76a693cd91650f9b4e83edac525e5e4f90d954e9 CWE-863

TI-2025-10245 CVE-2025-11183 · GHSA-gxp8-m5rq-3m38

Cross-Site Scripting Vulnerability in QWC2

MEDIUM 64

Cross-Site Scripting vulnerability in attribute table in QGIS QWC2 <2025.08.14 allows an authorized attacker to plant arbitrary JavaScript code in the page

CVSS 4.0MEDIUM 6.9 Network High privileges User interaction EPSS 0.00424 Published 2025-10-13 Fixed in 2025.08.14, 2025.8.14 CWE-79

TI-2026-71348 CVE-2026-104140

Stored cross-site scripting in QGIS Server WFS3 feature pages

MEDIUM 60

QGIS is a free, open source, cross-platform geographic information system.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00243 Published 2026-10-12 Fixed in 3.44.12 CWE-79

Open these records in search →

Critical	0
High	1
Medium	2
Low	0
No CVSS	0